@devrouter/cli 0.1.1 → 0.1.3

package/dist/devrouter-lifecycle-worker.js

@@ -23,8 +23,8 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // src/core/devpod-exec.ts
-var import_node_child_process29 = require("child_process");
-var import_node_crypto22 = require("crypto");
+var import_node_child_process30 = require("child_process");
+var import_node_crypto23 = require("crypto");
 
 // src/core/devpod-environment.ts
 var import_node_child_process3 = require("child_process");
@@ -1164,7 +1164,11 @@ function listDevpodWorkspacesRaw(options = {}) {
   }
   if (result.error || result.status !== 0) {
     const details = [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
-    throw new Error(`devpod list failed: ${details || "devpod is not installed or unavailable"}`);
+    const failure = new Error(
+      `devpod list failed: ${details || "devpod is not installed or unavailable"}`
+    );
+    if (result.error) failure.code = result.error.code;
+    throw failure;
   }
   let parsed;
   try {
@@ -1303,9 +1307,11 @@ function listDevsyWorkspaces() {
   );
   if (result.status !== 0) {
     const details = [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
-    throw new Error(
+    const failure = new Error(
       `devsy workspace list failed: ${details || "devsy is not installed or unavailable"}`
     );
+    if (result.error) failure.code = result.error.code;
+    throw failure;
   }
   let parsed;
   try {
@@ -1775,25 +1781,23 @@ function readWorkspaceRuntimeConfig() {
   }
   return config;
 }
+function readRegistrySnapshot(runtime, read2, snapshots) {
+  try {
+    return read2();
+  } catch (error) {
+    if (error?.code === "ENOENT") return void 0;
+    snapshots.unavailable.push(runtime);
+    snapshots.errors[runtime] = error instanceof Error ? error.message : String(error);
+    return void 0;
+  }
+}
 function getWorkspaceRegistrySnapshots() {
   if (cachedSnapshots) return cachedSnapshots;
   const snapshots = { unavailable: [], errors: {} };
-  if (isRuntimeInstalled("devsy")) {
-    try {
-      snapshots.devsy = listDevsyWorkspaces();
-    } catch (error) {
-      snapshots.unavailable.push("devsy");
-      snapshots.errors.devsy = error instanceof Error ? error.message : String(error);
-    }
-  }
-  if (isRuntimeInstalled("devpod")) {
-    try {
-      snapshots.devpod = listDevpodWorkspacesRaw();
-    } catch (error) {
-      snapshots.unavailable.push("devpod");
-      snapshots.errors.devpod = error instanceof Error ? error.message : String(error);
-    }
-  }
+  const devsy = readRegistrySnapshot("devsy", listDevsyWorkspaces, snapshots);
+  if (devsy !== void 0) snapshots.devsy = devsy;
+  const devpod = readRegistrySnapshot("devpod", listDevpodWorkspacesRaw, snapshots);
+  if (devpod !== void 0) snapshots.devpod = devpod;
   cachedSnapshots = snapshots;
   return snapshots;
 }
@@ -1954,7 +1958,7 @@ function selectDevpodWorkspace(workspaces, repoPath) {
 }
 
 // src/core/devsy-exec.ts
-var import_node_child_process28 = require("child_process");
+var import_node_child_process29 = require("child_process");
 
 // src/core/devsy-exec-proof.ts
 var import_node_fs7 = __toESM(require("fs"));
@@ -4040,11 +4044,19 @@ function absentRegistrationIdentity(state) {
   resetWorkspaceRuntimeCaches();
   if (resolveWorkspaceRuntimeOrDefault(state.repoPath) !== "devsy")
     throw new Error("Stop provider changed.");
-  if (!state.workspace || !isLinkedWorktree(state.repoPath))
-    throw new Error("Absent stop requires a linked workspace.");
-  const record5 = readWorkspaceOwnership(state.repoPath, state.workspace);
-  if (!record5 || record5.workspace !== state.workspace || record5.devpodId !== state.devpodId || !sameWorkspacePath(record5.worktreePath, state.repoPath) || resolveWorktreeWorkspace(state.repoPath) !== state.workspace || inspectWorkspaceOwnership(record5, listGitWorktrees(state.repoPath), void 0).ownerStatus !== "present")
-    throw new Error("Absent stop workspace ownership changed.");
+  const linked = isLinkedWorktree(state.repoPath);
+  if (linked !== (state.workspace !== void 0))
+    throw new Error("Absent stop requires the exact workspace identity.");
+  let identity2;
+  if (linked) {
+    const workspace = state.workspace;
+    const record5 = readWorkspaceOwnership(state.repoPath, workspace);
+    if (!record5 || record5.workspace !== workspace || record5.devpodId !== state.devpodId || !sameWorkspacePath(record5.worktreePath, state.repoPath) || resolveWorktreeWorkspace(state.repoPath) !== workspace || inspectWorkspaceOwnership(record5, listGitWorktrees(state.repoPath), void 0).ownerStatus !== "present")
+      throw new Error("Absent stop workspace ownership changed.");
+    identity2 = { kind: "linked", record: record5, gitCommonDir: resolveGitCommonDir(state.repoPath) };
+  } else {
+    identity2 = { kind: "primary", repoPath: state.repoPath, devpodId: state.devpodId };
+  }
   for (const entries of [
     listDevsyWorkspaces(),
     listDevpodWorkspacesRaw({ allowMissingExecutable: true })
@@ -4054,7 +4066,7 @@ function absentRegistrationIdentity(state) {
     ))
       throw new Error("Absent stop requires both provider registrations to remain absent.");
   }
-  return { record: record5, gitCommonDir: resolveGitCommonDir(state.repoPath) };
+  return identity2;
 }
 function replacementObservation(state) {
   resetWorkspaceRuntimeCaches();
@@ -4164,7 +4176,7 @@ function proveManagedStop(state) {
     const identityKeys = ["context", "providerId", "uid", "sourcePath", "sourceContainer"];
     const current = identityOf(owner.workspace);
     const changed = identityKeys.filter((key) => baseline[key] !== current[key]);
-    if (changed.length === 0 && state.workspace !== void 0 && isLinkedWorktree(state.repoPath) && inspectManagedStopContainers(baseline.project, baseline.endpoint).length === 0) {
+    if (changed.length === 0 && inspectManagedStopContainers(baseline.project, baseline.endpoint).length === 0) {
       proveAbsentPopulationStop(state, baseline, current);
       return { status: "proven-absent", containers: [] };
     }
@@ -4327,12 +4339,13 @@ function reliabilityFence(state) {
 }
 
 // src/core/reliability-operation-store.ts
-var import_node_crypto8 = require("crypto");
+var import_node_crypto9 = require("crypto");
 var import_node_fs17 = __toESM(require("fs"));
 var import_node_path21 = __toESM(require("path"));
 var import_node_util4 = require("util");
 
 // src/core/capacity-store.ts
+var import_node_crypto7 = require("crypto");
 var import_node_fs15 = __toESM(require("fs"));
 var import_node_path19 = __toESM(require("path"));
 
@@ -4393,11 +4406,13 @@ function evaluateCapacity(budgets, samples, charges, requested, nowMs, maxSample
 // src/core/capacity-store.ts
 var MAX_BYTES = 1048576;
 var CapacityHistoryError = class extends Error {
-  constructor(code) {
+  constructor(code, cause = null, location = null) {
     super(
       code === "capacity-ledger-lost" ? "Capacity ledger history is lost; restore verified capacity-reservations.json." : "Capacity history cannot be proven; inspect the private lifecycle journals."
     );
     this.code = code;
+    this.cause = cause;
+    this.location = location;
     this.name = "CapacityHistoryError";
   }
 };
@@ -4554,9 +4569,10 @@ var CapacityStore = class {
       const buffer = Buffer.alloc(MAX_BYTES + 1);
       const count = import_node_fs15.default.readSync(descriptor, buffer, 0, buffer.length, 0);
       if (count > MAX_BYTES) throw new Error("Capacity reservation snapshot exceeds byte limit.");
-      const value = JSON.parse(buffer.subarray(0, count).toString("utf8"));
+      const bytes2 = buffer.subarray(0, count);
+      const value = JSON.parse(bytes2.toString("utf8"));
       validate(value);
-      this.ledgerGeneration = `${stat.dev}:${stat.ino}`;
+      this.ledgerGeneration = this.generationIdentity(stat, bytes2);
       if (value.revision < minimumRevision) return { kind: "stale", revision: value.revision };
       this.observedLedger = true;
       return { kind: "intact", revision: value.revision, snapshot: value };
@@ -4609,20 +4625,30 @@ var CapacityStore = class {
     return snapshot;
   }
   commit(snapshot) {
-    this.write(this.file, serializeSnapshot(snapshot));
+    const contents = serializeSnapshot(snapshot);
+    this.write(this.file, contents);
     this.observedLedger = true;
-    this.rememberGeneration();
+    this.rememberGeneration(contents);
     this.establish();
   }
   /** Remember the published snapshot identity for the next generation fence. */
-  rememberGeneration() {
+  rememberGeneration(contents) {
     try {
       const stat = import_node_fs15.default.statSync(this.file);
-      this.ledgerGeneration = stat.isFile() ? `${stat.dev}:${stat.ino}` : void 0;
+      this.ledgerGeneration = stat.isFile() ? this.generationIdentity(stat, contents) : void 0;
     } catch {
       this.ledgerGeneration = void 0;
     }
   }
+  /**
+   * File identity plus content digest. Deleting and recreating the snapshot can
+   * reuse its inode number, so the inode alone cannot fence a replacement that
+   * reuses a revision number.
+   */
+  generationIdentity(stat, contents) {
+    const digest = (0, import_node_crypto7.createHash)("sha256").update(contents).digest("hex");
+    return `${stat.dev}:${stat.ino}:${digest}`;
+  }
   /**
    * Durable evidence that recorded history is gone, for a stop whose physical
    * cessation is already proven. The caller holds that proof; this writes no
@@ -4871,7 +4897,7 @@ var CapacityStore = class {
 };
 
 // src/core/controller-store.ts
-var import_node_crypto7 = require("crypto");
+var import_node_crypto8 = require("crypto");
 var import_node_fs16 = __toESM(require("fs"));
 var import_node_path20 = __toESM(require("path"));
 var CONTROLLER_SNAPSHOT_BYTES = 1048576;
@@ -5173,7 +5199,7 @@ var ControllerStore = class {
   provenance(identity2) {
     if (identity2.version !== 2) throw new Error("Controller binding provenance is unavailable.");
     return {
-      digest: (0, import_node_crypto7.createHash)("sha256").update(JSON.stringify(["devrouter-controller-binding-v1", identity2.store, identity2.key])).digest("hex"),
+      digest: (0, import_node_crypto8.createHash)("sha256").update(JSON.stringify(["devrouter-controller-binding-v1", identity2.store, identity2.key])).digest("hex"),
       enrolledEpoch: identity2.enrolledEpoch
     };
   }
@@ -5197,7 +5223,7 @@ var ControllerStore = class {
       if (!current || current.store !== captured.store || current.epoch !== captured.epoch || JSON.stringify(current.fingerprint) !== JSON.stringify(captured.fingerprint) || identity2?.version !== 2)
         throw new Error("Controller binding incarnation changed.");
       this.checkProvenance(current, identity2);
-      return (0, import_node_crypto7.createHmac)("sha256", Buffer.from(identity2.key, "hex")).update(JSON.stringify({ owner, config })).digest("hex");
+      return (0, import_node_crypto8.createHmac)("sha256", Buffer.from(identity2.key, "hex")).update(JSON.stringify({ owner, config })).digest("hex");
     };
   }
   read() {
@@ -5250,7 +5276,7 @@ var ControllerStore = class {
     const identity2 = existing?.version === 2 ? existing : {
       version: 2,
       store,
-      key: (0, import_node_crypto7.randomBytes)(32).toString("hex"),
+      key: (0, import_node_crypto8.randomBytes)(32).toString("hex"),
       enrolledEpoch: epoch
     };
     if (existing?.version !== 2)
@@ -5296,7 +5322,7 @@ var ControllerStore = class {
     if (!previous) {
       previous = {
         version: 2,
-        store: (0, import_node_crypto7.randomUUID)(),
+        store: (0, import_node_crypto8.randomUUID)(),
         epoch: 0,
         revision: 0,
         parkingRevision: 0,
@@ -5347,7 +5373,7 @@ function retain(session, previous) {
 
 // src/core/reliability-operation-store.ts
 function installedCliVersion() {
-  return true ? "0.1.1" : "0.0.0-dev";
+  return true ? "0.1.3" : "0.0.0-dev";
 }
 function compareCliVersions(left, right) {
   const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -5370,7 +5396,7 @@ function identityKey(identity2) {
   if (!import_node_path21.default.isAbsolute(identity2.repoPath) || import_node_path21.default.resolve(identity2.repoPath) !== identity2.repoPath || identity2.repoPath.includes("\0") || identity2.workspace !== null && !isReliabilityId(identity2.workspace) || !["devpod", "devsy"].includes(identity2.provider)) {
     throw new Error("Invalid reliability workspace identity.");
   }
-  return (0, import_node_crypto8.createHash)("sha256").update(identity2.repoPath).digest("hex");
+  return (0, import_node_crypto9.createHash)("sha256").update(identity2.repoPath).digest("hex");
 }
 function reliabilityOperationPath(identity2) {
   return import_node_path21.default.join(DEVROUTER_HOME, "reliability", `${identityKey(identity2)}.json`);
@@ -5487,6 +5513,7 @@ function validate2(record5, identity2) {
     "revision",
     "state",
     "worker",
+    "stopWorkStarted",
     "effectSequence",
     "outcome",
     "result",
@@ -5668,13 +5695,39 @@ function validate2(record5, identity2) {
       throw new Error("Reliability worker identity is invalid.");
     }
   }
+  if (record5.stopWorkStarted !== void 0 && record5.stopWorkStarted !== null) {
+    if (record5.stopWorkStarted !== true) throw new Error("Invalid stop work marker.");
+  }
+}
+var ReliabilityJournalError = class extends Error {
+  constructor(cause, location, message) {
+    super(message);
+    this.cause = cause;
+    this.location = location;
+    this.name = "ReliabilityJournalError";
+  }
+};
+var MAX_REPORTED_ENTRY_NAME = 160;
+var JournalFileGuardError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "JournalFileGuardError";
+  }
+};
+function journalEntryLocation(name) {
+  const printable = name.replace(/[^A-Za-z0-9._-]/g, "?");
+  return printable.length > MAX_REPORTED_ENTRY_NAME ? `${printable.slice(0, MAX_REPORTED_ENTRY_NAME - 3)}...` : printable;
 }
 function createLifecycleCapacityStore(directory = import_node_path21.default.join(DEVROUTER_HOME, "controller")) {
   return new CapacityStore(directory, void 0, () => {
     try {
       return listUnsettledCapacityBindings().floor;
-    } catch {
-      throw new CapacityHistoryError("capacity-history-unprovable");
+    } catch (error) {
+      throw error instanceof ReliabilityJournalError ? new CapacityHistoryError("capacity-history-unprovable", error.cause, error.location) : new CapacityHistoryError(
+        "capacity-history-unprovable",
+        "journal-enumeration-failed",
+        null
+      );
     }
   });
 }
@@ -5733,11 +5786,12 @@ function readBoundedPrivateJson(file, label) {
   try {
     const stat = import_node_fs17.default.fstatSync(descriptor);
     if (!stat.isFile() || stat.uid !== process.getuid?.() || stat.size > MAX_RECORD_BYTES || (stat.mode & 63) !== 0) {
-      throw new Error(`${label} is not a bounded private file.`);
+      throw new JournalFileGuardError(`${label} is not a bounded private file.`);
     }
     const bytes2 = Buffer.alloc(MAX_RECORD_BYTES + 1);
     const count = import_node_fs17.default.readSync(descriptor, bytes2, 0, bytes2.length, 0);
-    if (count > MAX_RECORD_BYTES) throw new Error(`${label} exceeds its byte limit.`);
+    if (count > MAX_RECORD_BYTES)
+      throw new JournalFileGuardError(`${label} exceeds its byte limit.`);
     return JSON.parse(bytes2.subarray(0, count).toString("utf8"));
   } finally {
     import_node_fs17.default.closeSync(descriptor);
@@ -5745,7 +5799,11 @@ function readBoundedPrivateJson(file, label) {
 }
 function assertReliabilityEnumerationTime(startedAtMs) {
   if (performance.now() - startedAtMs > MAX_RELIABILITY_ENUMERATION_MS)
-    throw new Error("Reliability journal enumeration exceeded its time limit.");
+    throw new ReliabilityJournalError(
+      "journal-enumeration-timeout",
+      null,
+      "Reliability journal enumeration exceeded its time limit."
+    );
 }
 function reliabilityDirectory() {
   return import_node_path21.default.join(DEVROUTER_HOME, "reliability");
@@ -5766,22 +5824,56 @@ function listReliabilityOperations() {
     stat = import_node_fs17.default.lstatSync(directory);
   } catch (error) {
     if (error.code === "ENOENT") return [];
-    throw error;
+    throw new ReliabilityJournalError(
+      "journal-directory-unreadable",
+      null,
+      "Reliability journal directory could not be read."
+    );
   }
   if (!stat.isDirectory() || stat.isSymbolicLink())
-    throw new Error("Reliability journal directory is unsafe.");
+    throw new ReliabilityJournalError(
+      "journal-directory-unsafe",
+      null,
+      "Reliability journal directory is unsafe."
+    );
   if (stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0)
-    throw new Error("Reliability journal directory is not private.");
+    throw new ReliabilityJournalError(
+      "journal-directory-unsafe",
+      null,
+      "Reliability journal directory is not private."
+    );
   const entries = [];
-  const handle = import_node_fs17.default.opendirSync(directory);
+  let handle;
+  try {
+    handle = import_node_fs17.default.opendirSync(directory);
+  } catch {
+    throw new ReliabilityJournalError(
+      "journal-directory-unreadable",
+      null,
+      "Reliability journal directory could not be read."
+    );
+  }
   try {
     for (; ; ) {
       assertReliabilityEnumerationTime(startedAtMs);
-      const entry = handle.readSync();
+      let entry;
+      try {
+        entry = handle.readSync();
+      } catch {
+        throw new ReliabilityJournalError(
+          "journal-directory-unreadable",
+          null,
+          "Reliability journal directory could not be read."
+        );
+      }
       if (!entry) break;
       entries.push(entry);
       if (entries.length > MAX_RELIABILITY_DIRECTORY_ENTRIES)
-        throw new Error("Reliability journal directory exceeds its entry limit.");
+        throw new ReliabilityJournalError(
+          "journal-enumeration-limit",
+          null,
+          "Reliability journal directory exceeds its entry limit."
+        );
     }
   } finally {
     handle.closeSync();
@@ -5790,27 +5882,82 @@ function listReliabilityOperations() {
   for (const entry of entries) {
     assertReliabilityEnumerationTime(startedAtMs);
     if (entry.isSymbolicLink())
-      throw new Error("Reliability journal directory contains a symlink.");
+      throw new ReliabilityJournalError(
+        "journal-entry-unsupported",
+        journalEntryLocation(entry.name),
+        "Reliability journal directory contains a symlink."
+      );
     if (!entry.isFile())
-      throw new Error("Reliability journal directory contains an unsupported entry.");
+      throw new ReliabilityJournalError(
+        "journal-entry-unsupported",
+        journalEntryLocation(entry.name),
+        "Reliability journal directory contains an unsupported entry."
+      );
     if (RELIABILITY_LOCK_NAME_RE.test(entry.name) || RELIABILITY_ATOMIC_TEMP_NAME_RE.test(entry.name))
       continue;
     const match = RELIABILITY_JOURNAL_NAME_RE.exec(entry.name);
-    if (!match) throw new Error("Reliability journal directory contains an unsupported entry.");
+    if (!match)
+      throw new ReliabilityJournalError(
+        "journal-entry-unsupported",
+        journalEntryLocation(entry.name),
+        "Reliability journal directory contains an unsupported entry."
+      );
     journals.push({ name: entry.name, key: match[1] });
   }
   if (journals.length > MAX_RELIABILITY_JOURNALS)
-    throw new Error("Reliability journal directory exceeds its journal limit.");
+    throw new ReliabilityJournalError(
+      "journal-enumeration-limit",
+      null,
+      "Reliability journal directory exceeds its journal limit."
+    );
   journals.sort((left, right) => left.name.localeCompare(right.name));
   const records = [];
   for (const journal of journals) {
     assertReliabilityEnumerationTime(startedAtMs);
     const file = import_node_path21.default.join(directory, journal.name);
-    const identity2 = journalIdentity(readBoundedPrivateJson(file, "Reliability journal"));
-    if (identityKey(identity2) !== journal.key)
-      throw new Error("Reliability journal filename does not match its identity.");
-    const record5 = readReliabilityOperation(identity2);
-    if (!record5) throw new Error("Reliability journal disappeared during enumeration.");
+    let raw;
+    try {
+      raw = readBoundedPrivateJson(file, "Reliability journal");
+    } catch (error) {
+      const fsCode = error?.code;
+      const cause = error instanceof JournalFileGuardError ? "journal-entry-unsafe" : error instanceof SyntaxError || !fsCode ? "journal-invalid" : "journal-unreadable";
+      throw new ReliabilityJournalError(
+        cause,
+        journalEntryLocation(journal.name),
+        error instanceof JournalFileGuardError ? error.message : cause === "journal-invalid" ? "Reliability journal entry is invalid." : "Reliability journal entry could not be read."
+      );
+    }
+    if (raw === void 0)
+      throw new ReliabilityJournalError(
+        "journal-unstable",
+        journalEntryLocation(journal.name),
+        "Reliability journal disappeared during enumeration."
+      );
+    let identity2;
+    let record5;
+    try {
+      identity2 = journalIdentity(raw);
+      if (identityKey(identity2) !== journal.key)
+        throw new ReliabilityJournalError(
+          "journal-identity-mismatch",
+          journalEntryLocation(journal.name),
+          "Reliability journal filename does not match its identity."
+        );
+      record5 = readReliabilityOperation(identity2);
+    } catch (error) {
+      if (error instanceof ReliabilityJournalError) throw error;
+      throw new ReliabilityJournalError(
+        "journal-invalid",
+        journalEntryLocation(journal.name),
+        "Reliability journal entry is invalid."
+      );
+    }
+    if (!record5)
+      throw new ReliabilityJournalError(
+        "journal-unstable",
+        journalEntryLocation(journal.name),
+        "Reliability journal disappeared during enumeration."
+      );
     records.push(record5);
     assertReliabilityEnumerationTime(startedAtMs);
   }
@@ -5886,7 +6033,7 @@ function clearStartupWitness(identity2, fence) {
 }
 
 // src/core/repo-config.ts
-var import_node_crypto9 = require("crypto");
+var import_node_crypto10 = require("crypto");
 var import_node_fs18 = __toESM(require("fs"));
 var import_node_path22 = __toESM(require("path"));
 var import_yaml3 = __toESM(require("yaml"));
@@ -7163,7 +7310,7 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs18.default.rea
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.1.1" : "0.0.0-dev";
+    const cliVersion = true ? "0.1.3" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver2(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -7342,7 +7489,7 @@ async function ensureNetwork(name) {
 
 // src/core/tls.ts
 var import_node_child_process13 = require("child_process");
-var import_node_crypto10 = require("crypto");
+var import_node_crypto11 = require("crypto");
 var import_node_fs19 = __toESM(require("fs"));
 var import_node_path23 = __toESM(require("path"));
 var DEFAULT_TLS_CERT_HOSTS = ["localhost", "*.localhost"];
@@ -7412,7 +7559,7 @@ function parseDnsHostsFromSubjectAltName(subjectAltName) {
   return normalizeUniqueHosts(names);
 }
 function parseCertificateDnsHosts(pem) {
-  const certificate = new import_node_crypto10.X509Certificate(pem);
+  const certificate = new import_node_crypto11.X509Certificate(pem);
   const subjectAltName = certificate.subjectAltName ?? "";
   if (subjectAltName.length === 0) {
     return [];
@@ -8241,6 +8388,41 @@ function stopInitialManagedDevsyWorkspace(repoPath, devsyId) {
     throw new Error("Initial managed stop left a workload running.");
   return true;
 }
+function restoreRecordedManagedDevcontainerConfig(repoPath) {
+  const plan = recordedManagedDevcontainerRestorePlan(repoPath);
+  if (!plan) return false;
+  writeManagedDevcontainerConfig(plan);
+  if (inspectManagedDevcontainerGeneratedConfig(plan).status !== "valid") {
+    throw new Error(
+      `Managed Dev Container path '${plan.generatedPath}' could not be restored from the recorded state.`
+    );
+  }
+  return true;
+}
+function recordedManagedDevcontainerRestorePlan(repoPath) {
+  try {
+    if (!import_node_fs21.default.existsSync(import_node_path25.default.join(repoPath, ".devrouter.yml"))) return void 0;
+    const linked = isLinkedWorktree(repoPath);
+    const workspace = linked ? resolveWorktreeWorkspace(repoPath) : void 0;
+    const state = readManagedRuntimeState(repoPath, workspace);
+    if (!state) return void 0;
+    const runtime = loadRuntimeConfig(repoPath, workspace ?? "", state.profile);
+    if (!runtime.config.managedRuntime || runtime.profile !== state.profile || runtime.workspace !== workspace)
+      return void 0;
+    const plan = inspectManagedDevcontainerConfig({
+      repoPath,
+      config: runtime.config,
+      profile: runtime.resolvedProfile,
+      linked
+    });
+    if (inspectManagedDevcontainerGeneratedConfig(plan).status !== "missing") return void 0;
+    if (plan.sourceConfigSha256 !== state.sourceConfigSha256 || plan.effectiveConfigSha256 !== state.effectiveConfigSha256)
+      return void 0;
+    return plan;
+  } catch {
+    return void 0;
+  }
+}
 function stopRetainedManagedDevsyWorkspace(options) {
   const { repoPath, devsyId } = options;
   const linked = isLinkedWorktree(repoPath);
@@ -8478,12 +8660,12 @@ function networkProviderEnvironment(binding, source) {
 }
 
 // src/core/network-claim-lookup.ts
-var import_node_crypto12 = require("crypto");
+var import_node_crypto13 = require("crypto");
 var import_node_fs24 = __toESM(require("fs"));
 var import_node_path28 = __toESM(require("path"));
 
 // src/core/network-claims.ts
-var import_node_crypto11 = require("crypto");
+var import_node_crypto12 = require("crypto");
 var import_node_fs23 = __toESM(require("fs"));
 var import_node_path27 = __toESM(require("path"));
 
@@ -9673,7 +9855,7 @@ function assertDirectory(directory) {
   }
 }
 function hashKey(value) {
-  return (0, import_node_crypto11.createHash)("sha256").update(value).digest("hex");
+  return (0, import_node_crypto12.createHash)("sha256").update(value).digest("hex");
 }
 function cloneFence(fence) {
   return { ...fence };
@@ -9701,7 +9883,7 @@ function claimError(code, message) {
 function networkOwnerKey(repoPath) {
   if (!import_node_path28.default.isAbsolute(repoPath) || import_node_path28.default.resolve(repoPath) !== repoPath)
     throw new Error("Invalid network owner path.");
-  return (0, import_node_crypto12.createHash)("sha256").update(repoPath).digest("hex");
+  return (0, import_node_crypto13.createHash)("sha256").update(repoPath).digest("hex");
 }
 function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
   let names;
@@ -9741,7 +9923,7 @@ function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
     } finally {
       import_node_fs24.default.closeSync(descriptor);
     }
-    if (typeof value.daemonId !== "string" || `${(0, import_node_crypto12.createHash)("sha256").update(value.daemonId).digest("hex")}.json` !== file)
+    if (typeof value.daemonId !== "string" || `${(0, import_node_crypto13.createHash)("sha256").update(value.daemonId).digest("hex")}.json` !== file)
       throw new Error("Retained network daemon identity is invalid.");
     const claim2 = readNetworkClaim({
       daemonId: value.daemonId,
@@ -9758,7 +9940,7 @@ function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
 
 // src/core/network-provider-inspect.ts
 var import_node_child_process15 = require("child_process");
-var import_node_crypto13 = require("crypto");
+var import_node_crypto14 = require("crypto");
 function object2(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     throw new Error("Invalid provider evidence.");
@@ -9778,7 +9960,7 @@ function qualifyNetworkProviderDefinition(value, provider) {
   if (definition.name !== "docker" || ![true, "true"].includes(agent.local) || agent.driver !== void 0 && agent.driver !== "docker" && agent.driver !== "" || docker.path !== "${DOCKER_PATH}" || docker.builder !== "${DOCKER_BUILDER}" || ![false, "false"].includes(docker.install) || (provider === "devsy" ? docker.elevation !== "${DOCKER_ELEVATION}" : docker.elevation !== void 0 && docker.elevation !== "") || env.DOCKER_HOST !== "${DOCKER_HOST}" || Object.keys(env).some((key) => key !== "DOCKER_HOST") || host.global !== true || dockerPath.default !== "docker" || actualCommand.length !== 1 || typeof actualCommand[0] !== "string" || actualCommand[0].trim() !== command || Object.keys(exec).some((key) => key !== "command") || agent.path !== void 0 && agent.path !== "" || agent.downloadURL !== void 0 && agent.downloadURL !== "") {
     throw new Error("Docker provider definition is not qualified for network allocation.");
   }
-  return (0, import_node_crypto13.createHash)("sha256").update(JSON.stringify({ name: definition.name, agent, options, exec })).digest("hex");
+  return (0, import_node_crypto14.createHash)("sha256").update(JSON.stringify({ name: definition.name, agent, options, exec })).digest("hex");
 }
 function read(provider, args) {
   const result = (0, import_node_child_process15.spawnSync)(provider, args, {
@@ -9996,6 +10178,7 @@ function inspectExactOwnership(devsyId, worktreePath) {
 }
 function mutateOwnedDevsyWorkspace(action, devsyId, worktreePath) {
   return withMutationLock(`Devsy ${action}`, worktreePath, () => {
+    restoreRecordedManagedDevcontainerConfig(worktreePath);
     if (action === "stop") {
       const stopped = stopRetainedManagedDevsyWorkspace({
         repoPath: worktreePath,
@@ -10161,7 +10344,7 @@ var ExecutionOutcomeError = class extends Error {
 };
 
 // src/core/reliability-lifecycle.ts
-var import_node_crypto21 = require("crypto");
+var import_node_crypto22 = require("crypto");
 var import_node_path40 = __toESM(require("path"));
 var import_node_util7 = require("util");
 
@@ -10170,7 +10353,7 @@ var import_node_fs26 = __toESM(require("fs"));
 var import_node_path30 = __toESM(require("path"));
 
 // src/core/controller-client.ts
-var import_node_crypto14 = require("crypto");
+var import_node_crypto15 = require("crypto");
 var import_node_fs27 = __toESM(require("fs"));
 var import_node_net2 = __toESM(require("net"));
 var import_node_path32 = __toESM(require("path"));
@@ -10185,7 +10368,7 @@ var CONTROLLER_PROFILE_RE = new RegExp(
 );
 
 // src/core/controller-monitor.ts
-var import_node_crypto15 = require("crypto");
+var import_node_crypto16 = require("crypto");
 var import_node_util6 = require("util");
 
 // src/core/reliability-output.ts
@@ -10516,7 +10699,7 @@ function handleOperationRequest(state, event) {
   if (state.phase === "stopping" || state.desired === "parked-for-capacity")
     return blocked(
       state,
-      `phase is '${state.phase}' with desired '${state.desired}'; wait for the running stop to finish.`
+      `phase is '${state.phase}' with desired '${state.desired}'; wait for the running stop to finish, or when no stop worker is running rerun 'devrouter stop <path> --delete', removing the exact provider registration first when the stop cannot prove the recorded population.`
     );
   if (event.kind === "exec" && (!event.runtimeRunning || state.desired !== "running" && state.intentRevision !== 0))
     return blocked(
@@ -10974,7 +11157,7 @@ function stepReliability(state, event, nowMs) {
 
 // src/core/reliability-worker.ts
 var import_node_child_process17 = require("child_process");
-var import_node_crypto16 = require("crypto");
+var import_node_crypto17 = require("crypto");
 var import_node_fs28 = __toESM(require("fs"));
 var import_node_path33 = __toESM(require("path"));
 
@@ -11043,7 +11226,7 @@ function workerGroupAbsent(pid) {
 }
 
 // src/core/workspace-ensure.ts
-var import_node_child_process27 = require("child_process");
+var import_node_child_process28 = require("child_process");
 var import_node_fs34 = __toESM(require("fs"));
 var import_node_path39 = __toESM(require("path"));
 
@@ -11742,7 +11925,7 @@ async function runManagedHostPreparation(repoPath, config) {
 
 // src/core/managed-post-start.ts
 var import_node_child_process22 = require("child_process");
-var import_node_crypto17 = require("crypto");
+var import_node_crypto18 = require("crypto");
 var import_node_fs31 = __toESM(require("fs"));
 var import_node_path36 = __toESM(require("path"));
 var MANAGED_MARKER = "devrouter:managed devcontainer";
@@ -11799,7 +11982,7 @@ function readRegularFile(filePath) {
   return readRegularFileBytes(filePath)?.toString("utf-8");
 }
 function adapterFingerprint(adapter) {
-  return (0, import_node_crypto17.createHash)("sha256").update(adapter).digest("hex");
+  return (0, import_node_crypto18.createHash)("sha256").update(adapter).digest("hex");
 }
 function resolveProcessHelperPath() {
   const candidates = [
@@ -11951,26 +12134,125 @@ function runManagedProcessAction(options) {
   return "drifted";
 }
 
+// src/core/managed-mount-nesting.ts
+var import_node_child_process23 = require("child_process");
+var NESTED_MOUNT_REASON = "no configured mount is nested inside another configured mount";
+var UNREADABLE_MOUNT_REASON = "the container's own mount table could not be read";
+function normalizeDestination(value) {
+  const trimmed = value.trim().replace(/\/+$/, "");
+  return trimmed === "" ? "/" : trimmed;
+}
+function isNestedWithin(destination, candidate) {
+  return candidate === "/" ? destination !== "/" : destination.startsWith(`${candidate}/`);
+}
+function unescapeMountField(value) {
+  return value.replace(
+    /\\([0-7]{3})/g,
+    (_match, octal) => String.fromCharCode(Number.parseInt(octal, 8))
+  );
+}
+function parseMountinfoDestinations(text4) {
+  const destinations = /* @__PURE__ */ new Set();
+  for (const line of text4.split("\n")) {
+    const fields2 = line.split(" ");
+    if (fields2.length < 5 || !/^\d+$/.test(fields2[0] ?? "")) continue;
+    destinations.add(normalizeDestination(unescapeMountField(fields2[4] ?? "")));
+  }
+  return [...destinations];
+}
+function isNestedIndex(destinations, index) {
+  return destinations.some(
+    (candidate, other) => other !== index && isNestedWithin(destinations[index] ?? "", candidate)
+  );
+}
+function configuredDestinations(configured) {
+  return configured.map((mount) => normalizeDestination(mount.Destination));
+}
+function classifyManagedMountNesting(configured, effectiveDestinations, containerId) {
+  const destinations = configuredDestinations(configured);
+  const nested = configured.filter((_mount, index) => isNestedIndex(destinations, index));
+  const identity2 = containerId ? { container: containerId } : {};
+  if (nested.length === 0) {
+    return { status: "not-applicable", checked: [], unwound: [], reason: NESTED_MOUNT_REASON };
+  }
+  if (effectiveDestinations === null) {
+    return {
+      status: "unverified",
+      checked: [],
+      unwound: [],
+      ...identity2,
+      reason: UNREADABLE_MOUNT_REASON
+    };
+  }
+  const effective = new Set(effectiveDestinations.map(normalizeDestination));
+  const checked = [];
+  const unwound = [];
+  for (const mount of nested) {
+    const destination = normalizeDestination(mount.Destination);
+    if (effective.has(destination)) {
+      checked.push(mount.Destination);
+      continue;
+    }
+    const nestedWithin = destinations.filter((candidate) => isNestedWithin(destination, candidate)).sort((a, b) => a.length - b.length)[0];
+    unwound.push({
+      destination: mount.Destination,
+      source: mount.Source,
+      nestedWithin: nestedWithin ?? "/"
+    });
+  }
+  return {
+    status: unwound.length > 0 ? "unwound" : "effective",
+    checked,
+    unwound,
+    ...identity2
+  };
+}
+function readContainerMountinfo(containerId, options) {
+  const result = (0, import_node_child_process23.spawnSync)("docker", ["exec", containerId, "cat", "/proc/self/mountinfo"], {
+    encoding: "utf-8",
+    timeout: options.timeoutMs ?? 5e3,
+    stdio: ["ignore", "pipe", "pipe"],
+    ...networkDockerOptions()
+  });
+  if (result.status !== 0 || typeof result.stdout !== "string") return null;
+  const destinations = parseMountinfoDestinations(result.stdout);
+  return destinations.length > 0 ? destinations : null;
+}
+function observeManagedMountNesting(container, options = {}) {
+  const destinations = configuredDestinations(container.mounts);
+  const effective = destinations.some((_destination, index) => isNestedIndex(destinations, index)) ? readContainerMountinfo(container.id, options) : null;
+  return classifyManagedMountNesting(container.mounts, effective, container.id);
+}
+
 // src/core/managed-runtime-status.ts
+function recoveryPath(repoPath) {
+  if (/^[A-Za-z0-9_@%+=:,./-]+$/.test(repoPath)) return repoPath;
+  return `'${repoPath.replaceAll("'", "'\\''")}'`;
+}
 function reliabilityRecovery(reason2, repoPath) {
+  const checkout = recoveryPath(repoPath);
   switch (reason2) {
     case "stop-incomplete":
     case "operation-unknown":
-      return [`Run: devrouter stop ${repoPath}`, `Run: devrouter ensure ${repoPath} --repair`];
+      return [`Run: devrouter stop ${checkout}`, `Run: devrouter ensure ${checkout} --repair`];
     case "start-refused":
       return [
-        `Run: devrouter doctor ${repoPath} to read the refused fixed host-port claim and its holder`,
-        `Stop the holding workspace or change this repository's own published binding, then run: devrouter ensure ${repoPath}`
+        `Run: devrouter doctor --repo ${checkout} to read the refused fixed host-port claim and its holder`,
+        `Stop the holding workspace or change this repository's own published binding, then run: devrouter ensure ${checkout}`
       ];
     case "unadmittable":
       return [
-        `Run: devrouter stop ${repoPath}`,
-        `Lower the requested capacity in .devrouter.yml, then run: devrouter ensure ${repoPath}`
+        `Run: devrouter stop ${checkout}`,
+        `Lower the requested capacity in .devrouter.yml, then run: devrouter ensure ${checkout}`
       ];
     case "capacity-parked":
-      return [`Run: devrouter ensure ${repoPath} (waits for capacity to free up)`];
+      return [
+        "Parked for host capacity: the enrolled foreground controller resumes this checkout after its pressure dwell and live-consumer checks pass.",
+        `Inspect the parked intent with: devrouter status --repo ${checkout} --json`,
+        `'devrouter ensure' refuses while the journal stays parked; release the intent instead with: devrouter stop ${checkout}`
+      ];
     case "capacity-waiting":
-      return [`Run: devrouter ensure ${repoPath} (still queued until capacity frees up)`];
+      return [`Run: devrouter ensure ${checkout} (still queued until capacity frees up)`];
     default:
       return [];
   }
@@ -12222,6 +12504,7 @@ function inspectManagedRuntime(options) {
     (mount) => mount.Type === "bind" && sameWorkspacePath(mount.Source, repoPath)
   )?.Destination;
   const primaryActive = Boolean(primary?.state.Running);
+  const mountNesting = primary && primaryActive ? observeManagedMountNesting(primary) : void 0;
   if (generatedConfigMissing && (state || primaryActive || managedServicesActive)) {
     drift.push("managed generated Dev Container configuration is missing");
   }
@@ -12288,7 +12571,8 @@ function inspectManagedRuntime(options) {
     processStatuses,
     activeServices: sortedUnique(activeServices),
     activeProcesses: sortedUnique(activeProcesses),
-    drift
+    drift,
+    ...mountNesting ? { mountNesting } : {}
   };
 }
 function collectManagedRuntimeStatus(options) {
@@ -12436,6 +12720,7 @@ function collectManagedRuntimeStatus(options) {
     baseServiceStatuses: inspection.baseStatuses,
     processStatuses: inspection.processStatuses,
     drift: sortedUnique(drift),
+    ...inspection.mountNesting ? { mountNesting: inspection.mountNesting } : {},
     ...inspection.plan?.sourceConfigSha256 || state?.sourceConfigSha256 ? { sourceConfigSha256: inspection.plan?.sourceConfigSha256 ?? state?.sourceConfigSha256 } : {},
     ...inspection.plan?.effectiveConfigSha256 || state?.effectiveConfigSha256 ? {
       effectiveConfigSha256: inspection.plan?.effectiveConfigSha256 ?? state?.effectiveConfigSha256
@@ -12445,19 +12730,19 @@ function collectManagedRuntimeStatus(options) {
 }
 
 // src/core/network-inventory.ts
-var import_node_child_process23 = require("child_process");
+var import_node_child_process24 = require("child_process");
 var NetworkInventoryError = class extends Error {
 };
 var MAX_IDS = 4096;
 var MAX_OUTPUT_BYTES = 2 * 1024 * 1024;
 var FULL_ID = /^[a-f0-9]{64}$/;
-var NETWORK_TEMPLATE = '{"id":{{json .Id}},"name":{{json .Name}},"driver":{{json .Driver}},"ipam":{{json .IPAM.Config}},"activeEndpoints":{{len .Containers}},"project":{{json (index .Labels "com.docker.compose.project")}},"network":{{json (index .Labels "com.docker.compose.network")}}';
+var NETWORK_TEMPLATE = '{"id":{{json .Id}},"name":{{json .Name}},"driver":{{json .Driver}},"ipam":{{json .IPAM.Config}},"activeEndpoints":{{len .Containers}},"project":{{json (index .Labels "com.docker.compose.project")}},"network":{{json (index .Labels "com.docker.compose.network")}}}';
 var CONTAINER_TEMPLATE = '{"id":{{json .Id}},"networks":{{json .NetworkSettings.Networks}}}';
 function readDocker(endpoint, args, timeoutMs) {
   const env = { ...process.env };
   delete env.DOCKER_CONTEXT;
   delete env.DOCKER_HOST;
-  const result = (0, import_node_child_process23.spawnSync)("docker", ["--host", endpoint, ...args], {
+  const result = (0, import_node_child_process24.spawnSync)("docker", ["--host", endpoint, ...args], {
     env,
     encoding: "utf-8",
     timeout: timeoutMs,
@@ -12488,7 +12773,14 @@ function id4(value) {
 }
 function rows(output) {
   const trimmed = output.trim();
-  return trimmed ? trimmed.split(/\r?\n/).map((line) => JSON.parse(line)) : [];
+  return trimmed ? trimmed.split(/\r?\n/).map((line) => parseRecord(line)) : [];
+}
+function parseRecord(line) {
+  try {
+    return JSON.parse(line);
+  } catch {
+    throw new NetworkInventoryError("Docker network inventory contains a malformed record.");
+  }
 }
 function ids(output) {
   const values = output.trim() ? output.trim().split(/\r?\n/).map(id4) : [];
@@ -12533,7 +12825,7 @@ function collectDockerNetworkInventory(options = {}, dependencies = {}) {
       return output;
     };
     const info = record4(
-      JSON.parse(
+      parseRecord(
         read2(["info", "--format", '{"id":{{json .ID}},"pools":{{json .DefaultAddressPools}}}'])
       )
     );
@@ -12614,7 +12906,7 @@ function collectDockerNetworkInventory(options = {}, dependencies = {}) {
 }
 
 // src/core/network-routes.ts
-var import_node_child_process24 = require("child_process");
+var import_node_child_process25 = require("child_process");
 var import_node_net3 = require("net");
 
 // src/core/network-local-daemon.ts
@@ -12683,7 +12975,7 @@ function parseLinuxNetworkRoutes(output) {
 function collectNetworkRoutes(options) {
   if ((options.platform ?? process.platform) !== "linux" || !hasLocalDockerNetworkNamespace(options.endpoint))
     return { status: "unknown", routes: [] };
-  const result = (0, import_node_child_process24.spawnSync)("ip", ["-j", "-4", "route", "show", "table", "all"], {
+  const result = (0, import_node_child_process25.spawnSync)("ip", ["-j", "-4", "route", "show", "table", "all"], {
     encoding: "utf8",
     timeout: 5e3,
     maxBuffer: 1024 * 1024
@@ -12719,10 +13011,10 @@ function inspectLegacyNetworkCapacity(input) {
 }
 
 // src/core/network-managed.ts
-var import_node_crypto20 = require("crypto");
+var import_node_crypto21 = require("crypto");
 
 // src/core/network-compose.ts
-var import_node_crypto18 = require("crypto");
+var import_node_crypto19 = require("crypto");
 var SAFE_ENDPOINT_UPPER_BOUND_SEMANTICS = "full-lifecycle-demand";
 function isRecord5(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -13528,12 +13820,12 @@ function stableValue(value) {
 }
 function fingerprintComposeNetworkModel(input) {
   const projection = normalizedFingerprintProjection(input);
-  return (0, import_node_crypto18.createHash)("sha256").update(stableValue(projection), "utf8").digest("hex");
+  return (0, import_node_crypto19.createHash)("sha256").update(stableValue(projection), "utf8").digest("hex");
 }
 
 // src/core/network-compose-files.ts
-var import_node_child_process25 = require("child_process");
-var import_node_crypto19 = require("crypto");
+var import_node_child_process26 = require("child_process");
+var import_node_crypto20 = require("crypto");
 var import_node_fs33 = __toESM(require("fs"));
 var import_node_path38 = __toESM(require("path"));
 var import_yaml4 = __toESM(require("yaml"));
@@ -13569,7 +13861,7 @@ function inspectNetworkComposeFiles(input) {
   const env = managedComposeEnvironment(input.workspace);
   delete env.DOCKER_CONTEXT;
   delete env.DOCKER_HOST;
-  const result = (0, import_node_child_process25.spawnSync)(
+  const result = (0, import_node_child_process26.spawnSync)(
     "docker",
     [
       "--host",
@@ -13604,7 +13896,7 @@ function prepareNetworkComposeFiles(plan, subnet) {
   const overlay = deriveComposeNetworkOverlay(subnet);
   if (overlay.status !== "ready" || !overlay.overlay) throw new Error("Network subnet is invalid.");
   const overlayPath = import_node_path38.default.join(plan.composeDirectory, OVERLAY);
-  const ignored = (0, import_node_child_process25.spawnSync)("git", [
+  const ignored = (0, import_node_child_process26.spawnSync)("git", [
     "-C",
     plan.composeDirectory,
     "check-ignore",
@@ -13634,7 +13926,7 @@ ${JSON.stringify(extended.config, null, 2)}
     ...plan,
     contents,
     composeFiles: [...plan.composeFiles, overlayPath],
-    effectiveConfigSha256: (0, import_node_crypto19.createHash)("sha256").update(contents).digest("hex")
+    effectiveConfigSha256: (0, import_node_crypto20.createHash)("sha256").update(contents).digest("hex")
   };
   return {
     plan: result,
@@ -13646,7 +13938,7 @@ ${JSON.stringify(extended.config, null, 2)}
 }
 
 // src/core/network-connected-route.ts
-var import_node_child_process26 = require("child_process");
+var import_node_child_process27 = require("child_process");
 function bounds(cidr) {
   const canonical = parseIPv4Cidr(cidr);
   if (!canonical) throw new Error("Invalid connected route.");
@@ -13671,7 +13963,7 @@ function inspectClaimedBridge(claim2, networkId) {
   const env = { ...process.env };
   delete env.DOCKER_CONTEXT;
   delete env.DOCKER_HOST;
-  const result = (0, import_node_child_process26.spawnSync)(
+  const result = (0, import_node_child_process27.spawnSync)(
     "docker",
     [
       "--host",
@@ -13698,7 +13990,7 @@ function inspectClaimedBridge(claim2, networkId) {
     const [first, last] = bounds(claim2.subnet);
     const [address] = bounds(gateway);
     if (address <= first || address >= last) throw new Error();
-    const interfaces = (0, import_node_child_process26.spawnSync)("ip", ["-j", "-d", "-4", "address", "show", "dev", bridge], {
+    const interfaces = (0, import_node_child_process27.spawnSync)("ip", ["-j", "-d", "-4", "address", "show", "dev", bridge], {
       encoding: "utf8",
       timeout: 5e3,
       maxBuffer: 65536
@@ -13952,7 +14244,7 @@ function createManagedNetworkSession(input) {
           "Insufficient endpoint headroom; request an allowed larger network before first allocation."
         );
       const authority = readNetworkOperationAuthority(identity2);
-      const fingerprint = (0, import_node_crypto20.createHash)("sha256").update(input.plan().sourceConfigSha256).update(fingerprintComposeNetworkModel(model)).digest("hex");
+      const fingerprint = (0, import_node_crypto21.createHash)("sha256").update(input.plan().sourceConfigSha256).update(fingerprintComposeNetworkModel(model)).digest("hex");
       if (!saved) {
         if (policy.status !== "valid")
           throw new Error("New network allocation requires valid machine policy.");
@@ -14454,7 +14746,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
         target
       });
       if (target.kind === "linked") {
-        const workspaceEnv = (0, import_node_child_process27.spawnSync)(
+        const workspaceEnv = (0, import_node_child_process28.spawnSync)(
           "docker",
           ["exec", appContainer.id, "printenv", "WORKSPACE"],
           { encoding: "utf-8", ...networkDockerOptions() }
@@ -14464,7 +14756,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
             `Workspace app container must expose WORKSPACE='${target.workspace}' (got '${workspaceEnv.stdout.trim() || "(empty)"}').`
           );
         }
-        const devrouterWorkspaceEnv = (0, import_node_child_process27.spawnSync)(
+        const devrouterWorkspaceEnv = (0, import_node_child_process28.spawnSync)(
           "docker",
           ["exec", appContainer.id, "printenv", "DEVROUTER_WORKSPACE"],
           { encoding: "utf-8", ...networkDockerOptions() }
@@ -14475,7 +14767,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
           );
         }
       }
-      const gitCheck = (0, import_node_child_process27.spawnSync)(
+      const gitCheck = (0, import_node_child_process28.spawnSync)(
         "docker",
         [
           "exec",
@@ -14755,7 +15047,7 @@ function isPrimaryCheckout(repoPath) {
 }
 function openUrls(urls) {
   for (const url of urls) {
-    const opened = (0, import_node_child_process27.spawnSync)("open", [url], { encoding: "utf-8" });
+    const opened = (0, import_node_child_process28.spawnSync)("open", [url], { encoding: "utf-8" });
     if (opened.status !== 0) {
       process.stderr.write(`Warning: could not open '${url}'.
 `);
@@ -15038,7 +15330,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
               transitionPhase = "service-start";
               reportLifecycleProgress("service-start");
               claimLifecycleEffect();
-              const result = (0, import_node_child_process27.spawnSync)("docker", ["start", ...stopped.map((entry) => entry.id)], {
+              const result = (0, import_node_child_process28.spawnSync)("docker", ["start", ...stopped.map((entry) => entry.id)], {
                 ...networkDockerOptions(),
                 encoding: "utf-8",
                 timeout: DEFAULT_READINESS_TIMEOUT_MS,
@@ -15982,6 +16274,11 @@ async function executeLifecycleWorker(request, operation) {
           ];
           for (const project of stopProjects) inspectManagedStopContainers(project);
         }
+        updateReliabilityOperation(request.identity, (record5) => {
+          if (!matchesFence(record5, request.fence))
+            throw new Error("Lifecycle intent changed before stop work began.");
+          record5.stopWorkStarted = true;
+        });
       } else {
         updateReliabilityOperation(request.identity, (record5) => {
           stepRecord(record5, {
@@ -16093,6 +16390,7 @@ function proveLifecycleStopped() {
     const settlement = updateReliabilityOperation(request.identity, (record5) => {
       if (!matchesFence(record5, request.fence) || record5.worker)
         throw new Error("Stop proof was superseded or an earlier worker remains.");
+      delete record5.stopWorkStarted;
       if (record5.version === 2) {
         if (record5.capacity) record5.capacity.validUntilMs = 0;
         return record5.state.environmentId;
@@ -16131,6 +16429,7 @@ function proveLifecycleStopped() {
         if (!matchesFence(record5, request.fence) || record5.worker || record5.state.environmentId !== settlement || record5.capacity && record5.capacity.validUntilMs !== 0)
           throw new Error("Capacity settlement was superseded before journal confirmation.");
         record5.capacity = null;
+        delete record5.stopWorkStarted;
         if (record5.enrollment) {
           record5.phaseSettlement = null;
           record5.activeProfile = null;
@@ -16184,7 +16483,7 @@ async function devsyExecOutcome(repoPath, command, retainedProof) {
         const launch = () => {
           if (retainedProof) revalidateDevsyExecProof(repoPath, retainedProof);
           claimLifecycleEffect();
-          return (0, import_node_child_process28.spawn)("devsy", args, { stdio: "inherit" });
+          return (0, import_node_child_process29.spawn)("devsy", args, { stdio: "inherit" });
         };
         child = retainedProof ? withMutationLock("Execute retained workspace", repoPath, launch) : launch();
       } catch (error) {
@@ -16232,7 +16531,7 @@ function ensureGuidance2(repoPath) {
   return `Run 'devrouter ensure ${repoPath}' first.`;
 }
 function assertRunningDevpod(devpodId, repoPath) {
-  const result = (0, import_node_child_process29.spawnSync)("devpod", ["status", devpodId, "--output", "json"], {
+  const result = (0, import_node_child_process30.spawnSync)("devpod", ["status", devpodId, "--output", "json"], {
     encoding: "utf-8"
   });
   if (result.status !== 0) {
@@ -16279,7 +16578,7 @@ async function devpodExecOutcome(repoPath, command) {
     }
     assertRunningDevpod(devpod.id, repoPath);
     const workspaceDirectory = resolveWorkspaceDirectory(repoPath);
-    const statusMarker = `__DEVROUTER_EXIT_${(0, import_node_crypto22.randomUUID)()}__:`;
+    const statusMarker = `__DEVROUTER_EXIT_${(0, import_node_crypto23.randomUUID)()}__:`;
     const statusMarkerBytes = Buffer.from(statusMarker, "ascii");
     const literalCommand = command.map(quotePosixArg).join(" ");
     const wrappedCommand = `${literalCommand}; __devrouter_status=$?; printf '${statusMarker}%s\\n' "$__devrouter_status" >&2; exit 0`;
@@ -16411,7 +16710,7 @@ async function devpodExecOutcome(repoPath, command) {
       let child;
       try {
         claimLifecycleEffect();
-        child = (0, import_node_child_process29.spawn)("devpod", args, { stdio: ["inherit", "inherit", "pipe"] });
+        child = (0, import_node_child_process30.spawn)("devpod", args, { stdio: ["inherit", "inherit", "pipe"] });
       } catch (error) {
         settled = true;
         reject(
@@ -16468,7 +16767,7 @@ async function devpodExecOutcome(repoPath, command) {
 }
 
 // src/core/workspace-lifecycle.ts
-var import_node_child_process30 = require("child_process");
+var import_node_child_process31 = require("child_process");
 var import_node_fs36 = __toESM(require("fs"));
 var import_node_path41 = __toESM(require("path"));